feat(12-02): add refresh_cloud_folder Celery task, staleness trigger, version 0.1.5

- Add tasks/cloud_tasks.py: durable refresh_cloud_folder task with 3-retry
  bounded backoff (30s/90s/270s +jitter), credential decryption in worker only
- Register tasks.cloud_tasks.* on documents queue in celery_app.py
- Add stale-while-revalidate staleness trigger in browse.py (5-min threshold)
- Add 4 Task 3 tests: idempotency, cached-row retention on failure, task structure,
  no-byte-download contract; add background-refresh scheduling integration test
- Bump backend version 0.1.4 → 0.1.5, frontend package.json 0.1.4 → 0.1.5
- Update AGENTS.md with Phase 12 Plan 02 state and new shared module map entries
- Update README with connection-ID browse API table and v0.1.5

README.md

@@ -1,6 +1,6 @@
 # DocuVault
 
-**Version 0.1.4 — Alpha**
+**Version 0.1.5 — Alpha**
 
 > **Not production-ready.** DocuVault is functional for local and self-hosted use but has not been audited or hardened for public internet exposure. APIs, environment variables, and the database schema may change without notice until a stable 1.0 release is declared.
 
@@ -39,7 +39,7 @@ A self-hosted, multi-user document management platform with AI-powered topic cla
 │  ├── api/documents.py                   │
 │  ├── api/folders.py                     │
 │  ├── api/shares.py                      │
-│  ├── api/cloud.py     (cloud backends)  │
+│  ├── api/cloud/         (cloud backends package)  │
 │  ├── api/admin.py                       │
 │  └── api/audit.py                       │
 └──┬──────────┬──────────┬───────────────┘
@@ -303,6 +303,19 @@ Users connect cloud storage through **Settings → Cloud Storage**. Credentials
 
 Connection statuses: `ACTIVE`, `REQUIRES_REAUTH`, `ERROR`. An externally revoked OAuth token transitions to `REQUIRES_REAUTH` without a 500 error.
 
+### Connection-ID Browse API (Phase 12)
+
+Each connected account is independently addressable by its connection UUID:
+
+| Endpoint | Purpose |
+|----------|---------|
+| `GET /api/cloud/connections` | List all connections (all providers, no credentials) |
+| `GET /api/cloud/connections/{id}/items` | Browse folder by connection UUID (stale-while-revalidate) |
+| `PATCH /api/cloud/connections/{id}` | Rename connection display name |
+| `DELETE /api/cloud/connections/{id}` | Remove connection and credentials |
+
+Browsing returns durable cached rows immediately and schedules a background `refresh_cloud_folder` Celery task to reconcile provider changes. First-visit fetches are synchronous and bounded. All browse responses are credential-free — `credentials_enc` is never serialized in the response.
+
 ---
 
 ## Security Highlights